Improper access control in OTRS - CVE-2018-14593
Published: October 15, 2018
Vulnerability identifier: #VU15368
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-14593
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.
The vulnerability exists due to improper access control restrictions when accessing certain URL. A remote authenticated attacker with agent privileges can escalate privileges and gain access to otherwise restricted functionality.
Affected software
OTRS
otrs (Alpine package)
Opensuse
SUSE Linux
otrs (Alpine package)
Opensuse
SUSE Linux
How to mitigate CVE-2018-14593
Install updates from vendor's website.
OTRS - addressed in versions 4.0.31, 5.0.29, 6.0.10
otrs (Alpine package) - update to 6.0.33-r0
otrs (Alpine package) - update to 6.0.33-r0